Deny access when a check fails

How to do it

Write checks so that access is the result of a clear yes, not the absence of a no. Catch errors in the check and turn them into a refusal. Test what happens when the identity service or database is down.

Example

// Bad: an error in the lookup falls through to "allowed"
let allowed = true;
try { allowed = await policy.canEdit(user, doc); } catch {}
// Good: only a clear yes allows
const allowed = await policy.canEdit(user, doc).catch(() => false);

# Python: any error in the check means no
try:
    allowed = policy.can_edit(user, doc)
except Exception:
    allowed = False

boolean allowed;
try { allowed = policy.canEdit(user, doc); } catch (Exception e) { allowed = false; }

How to check

Stop the permission service, or feed the check a malformed token, on staging. Protected routes answer 401, 403 or 503, never 200.